A Game Plan for Making Decisions Before,

During, and After a Crisis Hits Your Organization

John Hilley

Special Thanks To Our Sponsors

A Proud Sponsor of NonprofitWebinars.com

Helping ordinary people raise extraordinary amounts for nonprofits is all we do, and we love it.

Today’s Speaker

Hosting:

Sam Frank, Synthesis Partnership

John HilleyFounder and President,

Patmos LLC

Assisting with chat questions: April Hunt, Nonprofit Webinars

A GAME PLAN FOR MAKING DECISIONS BEFORE, DURING, AND AFTER YOUR ORGANIZATION FACES A CRISIS

JOHN R. HILLEYFOUNDER AND PRESIDENTPATMOS LLCJHILLEY@PATMOSCONSULTING.COMMAY 11, 2011

About the Presenter:

John R. Hilley, Founder and President of Patmos LLC.

John brings over 16 years experience in leadership in and consultancy to nonprofits. His work focuses upon helping build efficient, sustainable, and resilient nonprofit organizations through market-based assessments and solutions.

John is the creator of the Organizational Resiliency Game Plan (ORG) Tool, a business intelligence app for nonprofits, helping an organization strengthen its resiliency across a range of concerns from financial management to board governance to infrastructure issues. Not only working with nonprofits, he has provided business continuity management/disaster recovery planning for financial services companies and banks. Some of his past work has included developing business continuity response, relief & recovery efforts across 10 Louisiana parishes post Hurricanes Katrina & Rita. He is a frequent speaker on issues ranging from organizational resiliency and sustainability to business continuity and disaster preparedness to leadership approaches that lead to greater levels of commitment and accountability.

About Patmos:

We help organizations in good and bad times through incorporating planning tools such as the ORG Assessment Tool and offering practical, solutions based guidance and support through our consultative services, our software products, and workshops. Our nonprofit consulting projects range from targeted workshops on surviving environmental and economic disasters to ongoing consultative work aimed at improving organizational effectiveness and capacity building. Our clients range from small nonprofits planning for growth to midsize nonprofits with budgets of $1 million who are in need of aligning systems and processes for greater mission effectiveness to large regional nonprofits who need to ensure greater resiliency through having an executable business continuity plan.

Topics:

Resiliency as our guiding frame

Lessons Learned from organizations in my community of Nashville, TN (May 2010)

The importance of having a plan

Two Key Elements in the PlanAssessment of threats and vulnerabilitiesHow to make decisions in a crisis

The Incident Action Plan

Tips

.

Resilience - Our Guiding Frame for Today

Whether you are a community or an organization, the ability to “bounce back” – even to levels higher than before the crisis – is dependent upon:

1) The severity of the crisis

2) The level of planning that has been done before the crisis hits

3) The ability to be nimble and quick in your decision making

Resilience - Our Guiding Frame for TodayResilience - the capability of an organization to anticipate risk, limit impact, and bounce back rapidly through survival, and adaptability in the face of turbulent change.

Nashville’s Historic Flooding4th Largest non-hurricane natural disaster in US History. Hundreds of millions worth of damage. Every disaster is unique. What was unique about this is that the event kept escalating, especially when the flood gates of the dam were opened.

Lessons Learned from Nashville’s CrisisIssues for Our Nonprofits:

Workforce Concerns

Accounting for Employees

Communicating with Employees

Difficult for employees to make contact with managers and employers

Critical employees unable to fill position. No backups identified. People had not been cross trained.

Power Outage

Power outage drained cell phone batteries. No computer access.

Inability to access data

Access Issues

Access to data and access to facilities

Business Continuity

Critical dependencies weren’t mapped outTechnology: need for diverse providersFlooded facilitiesAgencies had not done advance planning which challenged their ability to respond to client needs

They also learned that in every crisis there is opportunity……partnerships…refocus of mission…an organizational culture of urgency and effectiveness

Disaster

Recovery

Business Continuity Plan (BCP)

The need for an organization to continue to function during and after a business interruption.

Crisis communications is part of the overall BCP

Disaster Recovery Plan

The ability to respond to an unplanned interruption and implement a technology and communications recovery plan and successfully restore an organization's critical

operational functions

Business

Continuity

Defining our Terms

A business continuity and crisis communications plan outlines a comprehensive approach to:

•ensure the continuity of essential services during an event

•Ensure the safety and well-being of employees

•Identify the emergency declaration of authority

•Ensure the safekeeping of records vital to the agency and its clients

•Obtain the emergency acquisition of records necessary for business resumption

•Ensure the capability to work at alternative sites until normal operations can be resumed.

•Provide coordinated crisis communications internally and externally to stakeholders.

Business

ContinuityBusiness Continuity Plan (BCP)

We have to maintain a strong.

FIVE KEY STEPS OF A PLAN

Governance

Assessment

Strategy

Execution

Metrics

We have to maintain a strong.

Process Description Tools/Competencies

Governance •Define and Align with Executive Priorities•Establish a steering/planning committee

•Project Management Tools: Software/ExcelSpreadsheet, Resources, Budget

Assessment •Gain an understanding of the risks•Report on risks and cost effective strategies to mitigate these

•Risk Assessment/Hazard Vulnerability•Business Impact Analysis

Strategy •Develop business continuity strategies ( communications plan, client needs, workspace, and data center)

•Templates•Cost/benefit•Industry benchmarking data

Execution •Document Plans •Planning software •Exercise

Metrics •Results monitoring •Goal/Metrics Table•Action Plan Measures

ASSESSMENT

•RISK AND VULNERABILITY ANALYSIS

•BUSINESS IMPACT ANALYSIS

(not covered in this presentation)

Samples of Types of Threats and Crises

Business Crises External Threats IT Threats Natural Disasters

•Access to Cash•Credit Challenges•Workplace Violence•Multiple Loss of Key Employees•Succession issues•Private Data Lost or Stolen•Media Scare (Real or Not)•Embezzlement/Fraud•Major promotional error•Supplier/Partner Problem (Disaster)

•Limited or no Property Access•Crisis in same industry•Government Restriction

•Network/Serversfailure•Power failure (internal or external)•Data Center flooded•Service Provider failure•Support equipment failure

•Tornado•Fire•Severe winter storm•Flood/flash flood•Earthquake•Hurricane•Extended cold/heat

“The most successful people are those who are good at Plan B.” –James York

RISK AND VULNERABILITY ANALYSIS

Analyze Threat Matrix

Select 2-3 Threats to include in your Plan

Include one Catastrophic Disaster that forces you to

leave your facility (fire, natural disaster)

Address a managerial threat (i.e. succession plan)

Address data loss or multiple systems failure

DECISION MAKING IN A CRISIS- AN INTERNAL FOCUSED FRAMEWORK FOR DECISION MAKING AND ACTION

Why do nonprofits activate their plans? – if it hasn’t been made clear already!

Incident Assessment – all you need to know! What is an Incident Action Plan (IAP) and why have one?

Who does the planning?

Building an Incident Action Plan

The Team Structure

“Interruption Declaration

Team”

(Executive Management and Emergency

Coordinator)

Incident Action Team

(“Emergency Management

Team”)

Operations/Program

(Key program concerns, customers)

Administration (HR, Accounting, Insurance)

Communication and Marketing

Facility (Physical Security, Salvage, Alternate Locations)

Technology

Security (Breach) –Healthcare Nonprofits

Recovery Teams

-Responsible for initial assessment– Review the criteria and escalation strategies for plan activation – determine to activate plan, yes or no

Life Safety/ People

• Are lives in danger? Is there an impact for our people?

• Is there a life safety issue?

Facilities

• Is our organization’s facility at risk?

Technology

•Disruption of technology services (e.g., telecom, network, data ctr.)?

Business - Financial

• Does the event impact our customers?

• Does the situation have a significant $ impact for our nonprofit?

Your Organization’s Reputation / Brand / Mission Critical Activities

• Does the event have a reputation impact for the organization?

• Does the situation have a significant impact for customers?

In Both Planning and Assessing –Your Primary Concerns

Assessing the Situation

Rank the event 0 - 3

Assessing: Your Activation CriteriaExamples of Crisis Levels

Level 0: An emergency that is handled as BAU. Examples would be a medical emergency or a short term building evacuation.

Level 1: An emergency that is limited in scope and can be addressed by the normal response of the organization. Examples would include a minor fire or a temporary power outage.

Level 2: An emergency that is moderate to severe in scope. Examples would include a moderate fire that closes parts of a building, a moderate earthquake with some damage.

Level 3: A catastrophic disaster that has severely damaged a mission critical facility requiring relocation of staff and business processes and/or severe disruption of services at that facility

Does incident meet activation criteria?–Yes• Activate the Emergency Management Team– No• Should the situation be monitored?–Yes, who on the IAT is in charge of monitoring, when is the next briefing and where?– No, follow-up using standard business practices.

Stakeholder LifeSafety/People

Facility Technology Financial Brand

Company

City

Region (e.g. flood, tornadoes)

Nation (e.g. 9/11)

International (e.g. Financial, Tsunami)

Activation Matrix

Who is on the team?

– Think back bone assessment (facilities, security, IT, Telecom) and then others depending on risks

-These staff members resource the “Recovery Teams” which are segmented around critical organizational functions

What is the IAT assignment?

– Use the initial Incident Action Plan of Executive Mgmt as the basis for decision making and communication

– Manage and Implement Response Strategies

How do they work together?

– How are they connected?

Communication tools: predetermine descending order of communications such as: 1) cell phone, land line, sms text, email, #800 hot line, mass notification

Determine office hours and after office hours notification strategy

– Conference bridge - virtual team at first?

– Where do they physically meet? (Always have a designated primary and secondary location)

Incident Action Team (aka “Emergency Management Team”)

An IAP contains:

– Overall incident status / strategy

– Specific strategic objectives and any necessary

supporting information

– Assignment of responsibility for each objective

– Next operational period.

The Plan may be oral or written (ideally

written).

– When written, the Plan may have a number of

forms as attachments

What is an Incident Action Plan?

1. Assess the incident situation – report the current

status of the event.

2. Establish strategic incident objectives. Ensure that

necessary resources are available to complete the

tasks.

- The objective criteria test: makes good sense (feasible, practical, and suitable); cost effective; consistent with sound environmental practices; safety norms; consider alternative strategies that may be employed)

3. Assign all objectives (to a team or individual).

4. Determine the operational period.

5. Communicate the plan to all identified stakeholders.

Creating an Incident Action Plan (IAP) during a Crisis

1. People

2. Facilities

3. Technology

4. Mission Critical Activities at Risk

5. Communication

(Security Breach)

Five Most Common “Buckets” of Your Concern

“Buckets” to Focus Objectives

People Facilities Technology Mission CriticalActivities

Commun-ication

Breach

•Account for all staff•Determine need for Employee Assistance Programs•Notify Emergency Contact.

•Conduct an initial damage assessment.•Contact contractors.•Appoint a liaison to work with ER responders.

•Conduct an initial assessment.•Reroute main number if unable to reoccupy in 15 minutes.

•Work with business units to determine what is affected.•Once known, what are the immediate workarounds that can be instituted.

•Communicate companystatus with key stakeholders •Update website•Update employee hotline.

•Breach action policies and procedures

The Payoff for an Intentional Method for Making, Communicating and Implementing Decisions –The 8 Cs

Incident Action

Plan

(Strategic)

Command

Communication

Consistency

Coordination

Client Confidence

Competitive Advantage

Control

Collaboration

Specific Steps:

The Recovery Teams

Each team needs to identify its responsibilities

and actions in the event of an interruption or crisis.

The responsibilities and actions should cover a

7 to 10 day period. “New Normalcy”

Specific Steps: Notification

•Develop Communication Procedures for:•For when the crisis occurs during Office Hours•For when the crisis occurs after Office Hours

•Segment Your Stakeholders and Assign a “relationship owner” to the entity•Board•Staff•Volunteers•Clients•Strategic Partners•Key Vendors•Media

•Identify level of criticality - who is notified first

•Develop steps and sequence for communication. This includes:

•Multiple points of communication (Cell, 800#, Wikki Site, non-office emails)•Scripts•Circulation of incident action plan across organization. (Consider turning it into PDF and circulate)

Specific Steps: Communicating Externally•When the Media is involved:

•One designated crisis management lead person (and team), directing and coordinating all aspects of the organization’s response, including managing the messages and the media and who interacts with the media and other inquirers. •Before Going Public•Assess the situation to determine the facts•Create plan of action for internal and external communications•Develop factual, detailed messages that reflect the status of the crisis, the organization’s response, and, if possible, proactive steps to resolve the situation.•Prepare talking points and provide a script for key staff (especially the receptionist) receiving incoming calls•Determine if a press release, web and/or voicemail updates are necessary•Assess what resources are necessary to manage the crisis (i.e. cell phone availability, press conference needs, off location site, on-location resources, signs, etc.)• Going Public•Communicate first to critical internal audiences (staff, board, volunteers, partners)•Begin media and other external audience outreach, use press release if appropriate•Update web site and organization phone mail, if needed•Evaluate message effectiveness as the situation progresses•Implement methods for updating key audiences with ongoing information•Distribute post-crisis communications

Specific Steps:

31

Create Emergency Call Trees

32

Specific Steps:

Determine Key Vendors

QUESTIONS

JOHN R. HILLEYFOUNDER AND PRESIDENTPATMOS LLCJHILLEY@PATMOSCONSULTING.COMMAY 11, 2011

Healthcare Business Continuity and

John R. Hilley, Founder and President, Patmos LLC

www.patmosconsulting.com

www.mygameplan.org

jhilley@patmosconsulting.com

615-538-7526 (PLAN)

Nashville, TN

THANK YOU!

Find the listings for our current season of webinarsand register at

NonprofitWebinars.com

Chris DumasChris@NonprofitWebinars.com

707-812-1234

Special Thanks To Our

Sponsors